A kiosk app in a supermarket has no reliable network and a promoter with physical control of the device. Any logic that runs on the device can be tampered with. The design answer is to decide outcomes on the server before the campaign, seal them, and let the device reveal rather than decide.
Tamper-evident record chains then make any interference detectable at sync, even though it could not be prevented at the time.